How to Audit an OpenClaw Skill Before Installing

OpenClaw has nearly 20,000 skills. Any of them can request file access, network permissions, or credential access. There's no built-in security review process — when you install a skill, you're trusting the author with your agent's capabilities.

Here's how to check a skill before you install it.

Step 1: Run a ClawAudit scan

The fastest way to check a skill is to run it through ClawAudit's free API. You don't need to install anything — just use curl or your browser:

Replace author/skill-name with the skill's registry slug. You'll get back a JSON response with a trust score (0-100), a tier rating, and a list of specific findings.

You can also use the search box on our homepage or browse the registry where we've pre-scanned every skill.

Step 2: Understand the trust score

The score tells you how safe the skill looks at a glance:

• 80-100 Trusted: No significant issues. Safe to install.
• 60-79 Caution: Minor concerns. Read the findings before installing.
• 40-59 Risky: Significant issues found. Review carefully or avoid.
• 0-39 Dangerous: Critical threats detected. Do not install.

The average score across the entire OpenClaw registry is 62.4 — that's Caution tier. The typical skill warrants a look before you trust it.

Step 3: Check the findings

The score is a summary. The real value is in the findings — each one tells you exactly what was detected and where:

{
  "severity": "critical",
  "category": "credential_harvesting",
  "description": "Access to environment variable API_KEY",
  "zone": "code",
  "line": 15
}

Findings are categorized by severity:

• Critical: Prompt injection, credential theft, obfuscated eval
• High: Data exfiltration patterns, dangerous shell commands
• Medium: Network access, file operations, package installation
• Low: Missing metadata, minor trust signal gaps

Step 4: Look at capabilities

ClawAudit extracts what a skill can do — its capabilities. Individual capabilities are often fine, but certain combinations are red flags:

• file_read + network_out = potential data exfiltration
• credential_access + network_out = credential theft
• process_exec + network_out = remote code execution

These compound threats are flagged separately in the audit results. A skill that reads your files is fine. A skill that reads your files and sends HTTP requests is suspicious.

Step 5: Check permission integrity

Well-behaved skills declare their permissions in YAML frontmatter. ClawAudit cross-references what a skill declares versus what it actually does:

• Undeclared capabilities: The skill does things it didn't ask permission for
• Unused declarations: The skill asked for permissions it doesn't use (less concerning but suspicious)

A skill that accesses your API keys without declaring credential_access in its frontmatter is either poorly written or deliberately hiding its behavior.

When in doubt, don't install

The 30 seconds it takes to run an audit can prevent credential theft, data exfiltration, or agent hijacking. If a skill scores below 60, read the findings. If it scores below 40, find an alternative.

Check the State of OpenClaw Security report for the full picture of what we found scanning all 19,461 skills.